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WHAT IS CLAIMED: 

1 . A method for mapping network attacks onto a strategy game, said method 
comprising: 

receiving, by a transformer, at least one log file, generated by network 
security monitoring tools; and 

transforming, by said transformer, said at least one log file into a set of 
characters with associated action inputs, wherein each of said characters is associated with 
an action input. 

2. The method according to claim 1, wherein said network security 
monitoring tools include off-the-shelf network security monitoring tools. 

3. The method according to claim 1, wherein said at least one log file includes 
different types of vendor-specific log files, generated by corresponding vendor-specific 
network security monitoring tools. 

4. The method according to claim 1 , further comprising: 

converting, using at least one log file transformer agent, said at least one 
log file into zero or more event representations; and 

mapping, by a security event transformer agent, said zero or more event 
representations to said set of characters and said associated action inputs. 

5. The method according to claim 4, wherein said event representations 
include a vendor-independent representation. 

6. The method according to claim 4, wherein each of said log file transfomer 
agents corresponds to one of said network security monitoring tools and converts a type of 
log file generated by said one of said network security monitoring tools to said event 
representation. 

7. The method according to claim 4, wherein said converting comprises: 
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analyzing each of said at least one log file generated by one of said network 
security monitoring tools; 

detecting zero or more events based on the result from said analyzing; and 
generating said zero or more event representations for said zero or more 

5 events. 

8. The method according to claim 4, wherein said mapping comprises: 

processing said one or more event representations; 

selecting a character for each of said event representations; 
p. determining an action input associated with each of said characters, 

ui 0 selected by said selecting, based on said each of said event representations; and 
11 storing said character and said associated action input in a format as a game 

? = session. 

r i 9. The method according to claim 8, wherein said format includes a saved 

i session format of a strategy game. 

,15 10. The method according to claim 1, further comprising: 

rendering said set of characters and said associated action inputs in the 
form of a strategy game; and 

displaying a result of said rendering on a screen of a display unit. 
11. A transformer for mapping network attacks onto a strategy game, said 
20 transformer comprising: 

a receiver configured to receive at least one log file generated by network 
security monitoring tools; and 

a transformer agent configured to transform said at least one log file into a 
set of characters with associated action inputs, wherein each of said characters is 
25 associated with an action input. 
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12. The transformer according to claim 11, wherein said network security 
monitoring tools include off-the-shelf network security monitoring tools. 

13. The transformer according to claim 11, wherein said at least one log file 
includes different types of vendor-specific log files, generated by corresponding vendor- 

5 specific network security monitoring tools. 

14. The transformer of claim 1 1 , wherein said transformer agent comprises: 

at least one log file transformer agent configured to convert said at least one 
log file into zero or more event representations; and 

a security event transformer agent configured to map said zero or more 
10 event representations to said set of characters and said associated action inputs. 

15. The transformer according to claim 14, wherein said event representations 
include a vendor-independent representation. 

16. The transformer according to claim 14, wherein each of said log file 
transformer agents corresponds to one of said network security monitoring tools and 

1 5 converts a type of log file generated by said one of said network security monitoring tools 
to said event representation. 

17. The transformer according to claim 14, wherein said at least one log file 
transformer agent analyzes each of said at least one log file generated by one of said 
network security monitoring tools, detects zero or more events based on the result from 

20 said analyzing, and generates said zero or more event representations for said zero or more 
events. 

18. The transformer according to claim 14, wherein said security event 
transformer agent processes said one or more event representations, selects a character for 
each of said event representations, determines an action input associated with each of said 
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characters, and stores said character and said associated action input in a format as a game 
session. 

19. The transformer according to claim 18, wherein said format includes a 
saved session format of a strategy game. 
5 20. A system for mapping network attacks onto a strategy game, said system 

comprising: 

a transformer configured to receive at least one log file generated by 
network security monitoring tools, and to transform said at least one log file into a set of 
characters with associated action inputs, wherein each of said characters is associated with 
10 an action input; and 

a strategy game rendering mechanism, said rendering mechanism 
configured to render said set of characters and said associated action inputs in the form of 
a strategy game. 

21. The system according to claim 20, further comprising a display unit 
15 coupled to said strategy game rendering mechanism, said display unit having a screen 

configured to display said strategy game. 

22. A computer-readable medium encoded with a plurality of processor- 
executable instructions for: 

receiving, by a transformer, at least one log file, generated by network 
20 security monitoring tools; and 

transforming, by said transformer, said at least one log file into a set of 
characters with associated action inputs, wherein each of said characters is associated with 
an action input. 

23. The computer-readable medium according to claim 22, wherein said 
25 network security monitoring tools include off-the-shelf network security monitoring tools. 
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24. The computer-readable medium according to claim 22, wherein said at least 
one log file includes different types of vendor-specific log files, generated by 
corresponding vendor-specific network security monitoring tools. 

25. The computer-readable medium according to claim 22, further comprising 
5 processor-executable instructions for: 

converting, using at least one log file transformer agent, said at least one 
log file into zero or more event representations; and 

mapping, by a security event transformer agent, said zero or more event 
representations to said set of characters and said associated action inputs. 
10 26. The computer-readable medium according to claim 25, wherein said event 

representations include a vendor-independent representation. 

27. The computer-readable medium according to claim 25, wherein each of 
said log file transformer agents corresponds to one of said network security monitoring 
tools and converts a type of log file generated by said one of said network security 

1 5 monitoring tools to said event representation. 

28. The computer-readable medium according to claim 25, wherein said 
converting comprises: 

analyzing each of said at least one log file generated by one of said network 
security monitoring tools; 
20 detecting zero or more events based on the result from said analyzing; and 

generating said zero or more event representations for said zero or more 

events. 

29. The computer-readable medium according to claim 25, wherein said 
mapping comprises: 

25 processing said one or more event representations; 
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selecting a character for each of said event representations; 
determining an action input associated with each of said characters, 
selected by said selecting, based on said each of said event representations; and 

storing said character and said associated action input in a format as a game 

session. 

30. The computer-readable medium according to claim 29, wherein said format 
includes a saved session format of a strategy game. 


